Analysis

  • max time kernel
    140s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 20:37

General

  • Target

    db2c807459b2b6f08eb19d1f7761e431_JaffaCakes118.exe

  • Size

    1005KB

  • MD5

    db2c807459b2b6f08eb19d1f7761e431

  • SHA1

    63bd129a1f60ed31621a3deb2f69c5839ba01cbb

  • SHA256

    7e5181417138e1c626fe549cf175124086791b0073b25ef36ce88d9b3333cfc8

  • SHA512

    33ddf2d452ba178906b727a80655ff46cb639427c7b2b72195e62091e10db76e5b9e1aed1d298a51e4be1b7081460e1b1e2f4664ff9508fe3e827abeb123548d

  • SSDEEP

    24576:hUfC5WLxQIF2ESjjeVRxkjjJG4RdN6Va0nqZf8qaGBldcPp:hUfC5WLxtfS3eujs4RH+M8qBldQ

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\db2c807459b2b6f08eb19d1f7761e431_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\db2c807459b2b6f08eb19d1f7761e431_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:4344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4344-0-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

  • memory/4344-2-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-3-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-1-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-6-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-7-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-4-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-5-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-8-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-9-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-10-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

  • memory/4344-11-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

  • memory/4344-12-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-13-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-14-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

  • memory/4344-15-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/4344-16-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

  • memory/4344-17-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

  • memory/4344-18-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

  • memory/4344-19-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB